ADRestore.NET rewrite

15 בדצמבר 2007

21 תגובות

Last month I had couple of clients that needed to restore accidentally deleted user and computer account. Though there is a command line version of tombstone reanimation tool called adrestore, the clients were not CLI savvies and having a GUI version of this functionality could really help them out. Some time ago I wrote a GUI version just for the case in VB.NET, but as it turned out it was quite buggy (well, it was one of my first .NET GUI apps), so I set down and rewrote the application from scratch in C#.

Now, if you are not familiar with the concept of tombstone reanimation, I would suggest that at this point you go and read Gil Kirkpatrick's article at Techent – it explains what tombstones are and how does the tombstone reanimation process works.

So, if you are aware of tombstone reanimation limitations (only a small set of attributes is restored), still willing to restore a deleted object and prefer a GUI version, you will probably find this little tool useful.

Main features:

  • Browsing the tombstones
  • Domain Controller targeting
  • Can be used with alternative credentials (convenient if you do not logon to your desktop as Domain Admin, which you should never do anyway)
  • User/Computer/OU/Container reanimation
  • Preview of tombstone attributes

Here are some sceenshots:

Enumerating tombstones


Previewing the tombstone attributes


Restoring a deleted user account


Notice that if you delete an OU with accounts in it, you will have to restore first the OUs the accounts were in, otherwise the reanimation of the child object will fail. It is not enough to create an OU with the same name as this will be a totally new object in AD and child object's lastKnowParent attribute will still reference the deleted OU. Here is a walthrough:

Initial state:


TestOU organizational unit is deleted:


State of tombstones (notice that lastKnownParent attribute of user and computer accounts reference the deleted OU):


OU is restored (lastKnowParent points to the restored OU's distinguished name):


Both computer and user accounts that resided in TestOU are reanimated:


Download ADRestore.NET

הוסף תגובה
facebook linkedin twitter email

כתיבת תגובה

האימייל לא יוצג באתר. שדות החובה מסומנים *

21 תגובות

  1. fmustafa23 בינואר 2008 ב 8:57

    Seems good tool, but it gives error "Fails to Enumerate available domains" although I use Enterprise Admin and Domain Admin account!! Any idea on how to fix this??

  2. Paul Slager23 בינואר 2008 ב 17:23

    I get a failed to enumerate availbe domains. The error was logon failure unknown username or bad password. I am a schema admin and running the tool both off my domain connected client and directly off the DC and I get the same message. I also try to use a different schema admin account but nothing shows up when I hit enemuerate the Domain list isnt populated.

  3. Edwin Bakkes25 בינואר 2008 ב 11:41

    I get the same error when i start de application

  4. Guy Teverovsky25 בינואר 2008 ב 14:57

    Thanks guys, I'm looking into it.

  5. Guy Teverovsky27 בינואר 2008 ב 2:43

    Guys, looks like you downloaded the version from Daniel Petri's website and the one there was an old version with a bug. I have updated the version on server, so you might want to give it another shot:

    Sorry for inconvenience,

  6. Aviad Avisar5 בפברואר 2008 ב 22:21


    כמה שאלות :
    האם זה יודע לשחזר גם ססמא של המשתמש?
    האם יודע לשחזר רק ATTRIBUTE אחד של אבוייקט?

  7. Guy Teverovsky6 בפברואר 2008 ב 0:17

    Hi Aviad, nice to see your here too 😉

    As for your questions:

    Q: "Can the tool restore the password?"
    A: No. The tool does not restore the object to the state it was before the deletion. All it does is to reanimate the tombstone (which has a very limited number of attributes left). I suggest that you read Gil's article at Technet about tombstones for better understanding the difference between authoritative restore of an object and tombstone reanimation:

    Q: Can the tool restore a single attribute ?
    A: No. All it does is to bring the tombstone alive. If you change an attribute of on object and want to roll it back, there is no tombstone of the object, so the tool won't even see it. Again, this has to do with the way the tombstones work.

    The tool is not supposed to be a full recovery tool, but in certain situations all you need is the account and the SID (i.e.: deleted service account) – this is where the tool comes useful and saves you the time needed for authoritative restore.

  8. Yann26 במרץ 2008 ב 22:09

    Very awesome tool !
    I get used of using adrestore in command line, but for a GUI-guy as I am, it is just awesome.

    Thanks for sharing your tool.



  9. Ian30 במאי 2008 ב 14:34

    This tool is fantastic! It’s just made restoring some accidently deleted computer accounts a piece of cake. Thank you very much!

  10. FutureFuust10 ביוני 2008 ב 12:28

    hey, i just tried your tool for an assignment no school (restoring an OU), I installed the GUI version and got the following error:

    "Fails to Enumerate available domains"

    I read in the reply's above this is a know issue, just wanted to let u know it is still there

    ps. the command line version did the job just fine


  11. Jeremy Stump1 ביולי 2008 ב 0:42

    Using Ldp i can see dns node entries which get deleted from our env. I dont see in this tool where we can display those too. Is that coming?

  12. Guy Teverovsky2 ביולי 2008 ב 16:16

    The tool currently filters out the object classes other than user/computer/organizationalUnit/container. I did not see much value in making it support all available object classes.
    Btw, why would you want to restore DNS records? Unless those were static, it's easier to let the hosts re-register dynamically (if allowed).

  13. Dan22 ביולי 2008 ב 0:51

    Hi Guy,
    I've accidentally deleted a user with the administrative rigths on my laptop. Can I restore it by using your tool?
    I would grately appriciate any help you can provide.

    Thank you

  14. Guy Teverovsky22 ביולי 2008 ב 1:14


    The tool works only with Active Directory accounts. In order to restore local account you will probably have to revert to a Restore Point dated before the account deletion.

  15. Nils Kaczenski11 בספטמבר 2008 ב 2:24


    awesome. Just for your information and for everyone who needs it: I created a small script-based tool ("Werding") that helps in tombstone recovery.

    It does an attribute export of AD objects (when they still exist) and can write those attributes back to re-animated tombstones. That way you can recover additional data such as address data, but most importantly group membership of recovered objects. (The password will not be recovered, though. You have to set a new one, but that's better anyway.)

    See the international version at:
    [ » Werding v2 (English version): Online data recovery for Active Directory]

    Bye, Nils

  16. Ernst19 בספטמבר 2008 ב 4:19

    Hi Guy,

    Is it necessary to boot the server in ad restore mode?



  17. Ernst19 בספטמבר 2008 ב 4:19

    Hi Guy,

    Is it necessary to boot the server in ad restore mode?



  18. Guy Teverovsky19 בספטמבר 2008 ב 9:16

    Ernst, no need to boot into DSRM. This is tombstone reanimation and not authoritative restore

  19. Nugita10 בנובמבר 2008 ב 13:50

    Hy Guy

    Great tool, it helpded me restoring OU and workstations because a stupid AD especialist deleted all of them.
    One question …. Is there any way we can do a bulk restore (ie. workstations within the same OU)?


  20. Ed9 בינואר 2009 ב 0:46

    Hey Guy,

    Great tool! Is there a way to select multiple objects? I need to restore over 100 computers…


  21. Carlos4 בפברואר 2009 ב 21:07

    I run the tool and I was able to see the computers recovered, just after I restored the OU. BUT, I can't log the PCs in the AD domain… am I missing something?